Dunnington CE Primary School City of York Council Internal Audit Report 2015/16

Business Unit: Primary Schools, Headteacher: C Hancy Date Issued: 06/01/16 Status: Final Reference: 15613/003

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Substantial Assurance | Introduction This audit was carried out on Thursday 15th October and Friday 16th October 2015 as part of the Internal Audit plan for Education, Skills and Children’s Services for 2015/16.

Objectives and Scope of the Audit The purpose of this audit was to provide advice to the Governors, Head Teacher and the Authority's Section 151 Officer about the financial management procedures and assurance that internal controls of the school were operating effectively to manage key risks, both financial and otherwise. The audit covered the following areas in accordance with the specification issued on 15th September 2015:

- Governance;
- Financial Management;
- System Reconciliation;
- Petty Cash
- Contracts – Ordering, Purchasing and Authorisation;
- Income;
- Capital and Property;
- Additional School Activity Provision;
- Human Resources;
- Payroll;
- School Meals;
- Pupil Numbers;
- Voluntary Funds Monitoring Arrangements;
- Data Protection and Information Technology;
- Insurance and Risk Management;
- Joint Use Facilities;
- Inventory Records;
- Minibus.
- Security; and
- Safeguarding Arrangements. Key Findings The key findings in the audit related to ensuring Finance Committee meetings take place at least termly, completing a comprehensive benchmarking exercise, review of contract arrangements, arranging for an audit of the schools fund and ensuring adequate controls are in place to protect personal or sensitive data.

Overall Conclusions It was found that the arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance 1 Finance Committee Meetings

| Issue/Control Weakness | Risk | |------------------------|------| | The Finance Committee has not met on a termly basis. | Failure to comply with the school’s budget management policy and committee terms of reference. |

Findings

The last meeting of the Finance Committee took place on 13/2/15 to discuss the 2015/16 start budget. No subsequent meeting has taken place, with financial issues being addressed through the Full Governing Body. The school’s budget management policy and terms of reference require that the Finance Committee meets at least termly. It was also noted that the minutes of the finance committee were not signed and dated as approved by the Chair. It is understood that minutes are presented to the next Full Governing Body Meeting. Assurance was given that the revised budget had been discussed and approved by the FGB 30/9/15. The minutes of this meeting were not yet available for the audit.

Recommendation

It is recommended that the finance committee meets at least termly in accordance with the school’s budget management policy and committee terms of reference. However, if the governors wish to incorporate the business of the Finance Committee into the Full Governing Body meeting this intention should be clearly stated as an exception to the policy in the committee minutes. Minutes of all sub committee meetings should be signed and dated on approval.

Agreed Action 1.1

Minutes of the Full Governing Body dated 30.09.15 confirmed the Revised Budget approval and monitoring reports presented to Governors. Termly meetings of the Finance Committee will be agreed at the Full Governing Body meeting on 19.11.15.

| Priority | 3 | |----------|---| | Responsible Officer | Office Manager | | Timescale | 19 November 2015 |

## 2 Benchmarking

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | There has been no comprehensive benchmarking exercise completed for the school in the last 12 months. | Spend may not be effectively targeted, savings may not be identified, and value for money may not be achieved. |

### Findings

A full benchmarking exercise had not been completed for some time (last presented March 13), although assurance was given that comparisons are completed when looking at particular areas of spend.

### Recommendation

A benchmarking or comparative exercise to identify whether there are particular areas of spend where the school may be challenged and could potentially make savings should be completed and the results presented to governors for discussion.

### Agreed Action 2.1

Benchmarking has taken place for specific areas of concern, eg TA costs. Benchmarking will take place during the Spring Term, in line with setting the Start Budget and will be presented to Governors at the Finance Committee during this term.

| Priority | Responsible Officer | Timescale | |----------|---------------------|--------------------| | 3 | School Business Manager | 31 March 2016 | 3 Contract Review

| Issue/Control Weakness | Risk | |------------------------|------| | There is no evidence that all service contracts at the school are periodically reviewed and market tested or re-tendered where necessary. | Best value may not be obtained on school service contracts. |

Findings

A central record of all service contracts at the school is in place but has not been updated. Contract documentation for the main service contracts at the schools was reviewed, however the contract for IT support was not available for the audit. It was noted that arrangements for grounds maintenance are on a continuing basis. There is no evidence to confirm that contractual arrangements are periodically reviewed to ensure they meet current requirements and are programmed for re-tender or market testing where applicable.

Recommendation

It is recommended that the schedule of current contracts is updated and contract review at the school is evidenced through review of this document.

Where appropriate contracts should be periodically market tested (eg lower value continuing arrangements) and where the end of the contract period is approaching a re-tender exercise should be planned with consideration being given to possible cluster group purchasing arrangements.

Agreed Action 3.1

The School Business Manager is compiling an up to date contract review schedule for the school and an audit of contracts will be undertaken and reviewed as required.

| Priority | 3 | |----------|---| | Responsible Officer | School Business Manager | | Timescale | 31 December 2015 |

### 4 Extended School Activity

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The annual lease charge received from Dunnington Children has not been subject to a full review against costs to ensure the charge is appropriate. | There may be a net cost to the school in relation to the lease with Dunnington Children. |

#### Findings

Dunnington Children provide breakfast club and after school provision under an agreement with the school and the diocese which has been in place for a number of years. A copy of the agreement was not available at the audit. It is understood that the rental received from Dunnington Children has not been increased. Costs have not been formally reviewed against income received therefore it is not clear whether there is any net cost to the school and therefore whether consideration should be given to revising the agreement and increasing the rental charge.

#### Recommendation

The agreement and rental charge for Dunnington Children should be reviewed. This should include an analysis of costs to the school against income received over the period of the agreement.

#### Agreed Action 4.1

The transfer of Control Agreement is to be reviewed. Actual costs of repairs and maintenance for the last three years will be reviewed and noted. The annual rent will be reviewed during the Spring Term and Dunnington Children informed in writing of the decision made.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------------| | 3 | Office Manager | 31 March 2016 |

## 5 School Fund

| Issue/Control Weakness | Risk | |------------------------|------| | The school fund accounts to 31/7/14 and 31/7/15 have not been audited. The Governors have not received information on the operation of the fund since the audited accounts for 31/3/13 were presented. | Failure to comply with the requirements of the Scheme for Financing Schools. The operation of the school fund may not be in line with Governor requirements. |

### Findings

The last audit of the school fund was completed to 31/7/13. The Scheme for Financing Schools (section 2.8) requires that schools must provide audit certificates for all voluntary and private funds. There is currently little activity through this fund however, it was noted that the last bank reconciliation was completed at year end 31/7/13. The accounts to 31/7/13 were presented to the Governors 30/1/14. There has been no report to governors on the activity of the school fund since then.

### Recommendation

The school should ensure the school fund has an annual audit certificate and that the audited accounts and a report of the operation of the fund is presented to Governors. A bank reconciliation should be completed at least termly to ensure that any discrepancies can be queried promptly.

### Agreed Action 5.1

A member of the Governing Body is to undertake the audit of the School Fund accounts.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Office Manager | 31 December 2015 | 6 Encryption

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The school may be holding unencrypted personal data on data storage devices which may be vulnerable to being lost or stolen. | Statutory requirements may be breached. The ICO has powers to levy fines of up to £500,000 for the most serious breaches of the data protection act. |

Findings

The school has a laptop policy which is signed by each member of staff allocated a laptop. This specifies that no sensitive data should be held on memory sticks and that photographs held on any personal portable devices must be downloaded to the school’s S:drive and immediately removed from the device. Laptops are not encrypted and encrypted memory sticks are not available at the school. The Information Commissioner recommends that all portable storage media that may hold sensitive personal information is encrypted. Where unencrypted laptops, memory sticks have been lost or stolen enforcement action will usually be applied.

Recommendation

The school should ensure that laptops or other portable storage devices are not used to hold personal data. If it is possible that personal data is held on any of these devices it is advised that they are encrypted. Advice on encryption has been sent to the school.

Agreed Action 6.1

Encryption has been enabled on staff laptops by XMA so that any off line files are automatically encrypted. The Staff Laptop Policy guidance on how to store files outside of ‘my documents’ is to be updated and re-issued to staff for signing.

| Priority | 3 | |----------|---| | Responsible Officer | Headteacher | | Timescale | 31 December 2015 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.